topic User-id not updating mappings fast enough in General Topics

User-id not updating mappings fast enough

Gun-Slinger — Thu, 03 Sep 2015 20:39:20 GMT

We have 2 user-agents deployed that read the AD logs and the PA7050's connect to the user-agents. The agents are running 6.0.7-10 and the PA7050's running 6.1.4.

We are having a problem where mulitple machines across various networks are using a "generic" login account. We have policies in place on the PA7050's that are enforced on these macihines through user-id. This works fine until an admin logs into one of these machines or runs an application as an admin on the machine. This over-writes the user-id mapping by design. The issue however comes when the admin logs out and then logs back in as the generic account, the user-id mappings are not being updated fast enough or at all it seems, which then leaves that machine to bypass the enforcment policies.

Has anyone else run into this issue?

Thanks

**I have thought of using the ignore-list for the admin login's, however this would be a few 100 names and could change monthly which is not really scable to daily operations.

Re: User-id not updating mappings fast enough

OtakarKlier — Thu, 03 Sep 2015 23:05:41 GMT

Hello,

Not sure if its acceptable in your environemnt, but perhaps wmi probing could be used? Just be careful of where you have it enabled:

User-id Best practices:

https://live.paloaltonetworks.com/t5/Learning-Articles/Best-Practices-for-Securing-User-ID-Deployments/ta-p/61606

Security impact of wmi probing

https://live.paloaltonetworks.com/t5/Learning-Articles/Customer-advisory-Security-Impact-of-User-ID-Misconfiguration/ta-p/59968

Re: User-id not updating mappings fast enough

OtakarKlier — Thu, 03 Sep 2015 23:15:30 GMT

Or maybe Captive portal, although I must admit I think it would be for all users.

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/user-id/map-ip-addresses-to-user-names-using-captive-portal.html

Re: User-id not updating mappings fast enough

Brandon_Wertz — Fri, 04 Sep 2015 14:45:21 GMT

Maybe I'm mistaken, but in the user-agent config,the "Security Log Monitor Fequency (sec.)" setting should take care of this for you.

The login / run-as from the admin, log-off and subsequent login as a normal user should be recorded within this setting. In our enviornment this is set as 3 seconds. So unless I'm not understanding this correctly our enviornment would have this updated in 3 seconds or so, and would also take care of your issue as well.

Re: User-id not updating mappings fast enough

cpainchaud — Fri, 04 Sep 2015 20:03:31 GMT

Global Protect in internal mode or wifi/nac logs are the only options. Anything else is just noise.